1. Statewide Exercise 2017 Initial Planning Meeting
22 June2016

2. Admin Notes Please Sign In All Partners Access Network (APAN)
Cell Phones- Mute/Vibrate
Please step out if need be
WIFI Info: Open Network
Bathroom Locations

3. Proposed Participants
Title 10, 33, or Allocated
to US NORTHCOM
Title 32/SAD
Partner Agencies
JFHQ-MI
46 MP CMD
MING Cyber Network Defense
MING Cyber Protection Team
ARNORTH Region V DCO
107 EN BN
USCG
Michigan State Police, Emergency Management and Homeland Security
Michigan Department of State Police
FEMA Region V
Michigan Department of Health and Human Services
Michigan Department of Environmental Quality (MI-DEQ)
Michigan Department of Transportation
Michigan Department of Environmental Quality
Michigan Department of Corrections
Michigan Department of Agriculture and Rural Development
Michigan Department of Regulatory and Licensing
Michigan Department of Technology, Management and Business
Participation Status
Confirmed
Pending

4. Agenda Time Subject Presenter 0830 Introductions & Admin Notes
Ms. Amanda Bresler
0845
Senior Leader Remarks
Capt. Chris Kelenske
LTC Ryan Connelly
0900
NE15 Lessons Learned & NE17 Design Overview
Mr. Mike Bridges
0930
NE17 Objectives & Requirements
LTC Ravindra Wagh
1000
Workgroup Discussion
1100
Objective & Workgroup Confirmation
1200
IPM Summary, Due Outs and Way Forward
Release

5. Chief of Plans & Exercise, MI ARNG
Senior Leader Remarks
Capt Chris Kelenske
Commander, MSP/EMHSD
LTC Ravindra Wagh
Chief of Plans & Exercise, MI ARNG

6. 14 Venues across 8 Michigan Communities
NORTHERN EXPOSURE 15
What
NORTHERN EXPOSURE 15 was a MING CBRN consequence management exercise conducted from June 2015 through out Michigan focused on the State, Regional, and Federal response to complex catastrophic nuclear event.
14 Venues across 8 Michigan Communities
- Muskegon
- Grand Rapids
- Kentwood
- Fort Custer/
Battle Creek
- Alpena CRTC
- Camp Grayling
- Detroit / Selfridge
Path Forward for Improvement
NORTHERN EXPOSURE 17
Conduct a continuous 3-day response to a complex catastrophe focused on the civilian to military partnership
Continue to Increased MING interagency understanding and cooperation through incorporation of Military and Civilian Federal, State and Local partners
Exercise the transition of responsibilities from JFHQ-MI to the MING Dual Status Command Joint Task Force
Exercise Objectives Achieved
Confirmed the readiness of Michigan National Guard (MING) units allocated to United States Northern Command (US NORTHCOM) CBRN Response Enterprise
Confirmed the readiness of MING units to provide capability and support for State civil support missions
Increased MING interagency understanding and cooperation through incorporation of Military and Civilian Federal, State and Local partners
Exercised MING Dual Status Commander and Staff in employment of State (SAD/Title 32) and Federal (Title 10) forces during a complex catastrophe
Conducted an Deployment Readiness Exercise Level III of select C2CRE-B TSF units
- Lansing
Urban Search and Rescue
Dual Status Command
Who Participated
Muskegon Heights FD
Kent County Tri-Community FD
US NORTHCOM
FBI
FEMA
Army National Guard
Air National Guard
US Army North
Michigan State Police
Michigan Dpt of Health & Human Services
Michigan Dpt Environmental Quality
Michigan SAR Task Force 1
City of Grand Rapids
Kent County
City of Battle Creek PD
Muskegon County
Over 2,500 responders and support personnel participated from Federal, State, and Local Partners
Webb and Sun Chemical
Kent County Sheriff
Interagency Cooperation
MING Reaction Force
Deployment Readiness
POC
LTC Raymond Stemitz, ACoS G5 Plans and Exercise
or at (517)

7. 2015 Exercise Lessons Learned
Interagency relationships must be predictive, habitual.
Understanding agency/unit capability is critical in Incident Command System (ICS).
Use of agency jargon & acronyms negatively impact communications.
Need to synchronize and prepare for systems that are not designed to be compatible.
Exercise vs Validation.
Understand the intent of the exercise.

8. 2017 Proposed Planning Timeline
= Publication
= 2017 Event
01 AUG AAR
= MING Only Event
14-17 JUN NE 17 Exercise Window
11-13 JUN Exercise Rehearsal & COMMEX
*COA2: 26MAR-04APR 17
19-28 MAR MSEL Writing Session – Lansing COA 1*
MAR Final Planning Meeting - Lansing
06 MAR NE17 TTX – Lansing
JFHQ-MI
CPX16
(Internal MIARNG)
28 FEB Publish Exercise Plan
List of CRE Operational events/activities
- IDT
- AT
- Fielding’s
- Exercises
- Conferences
10-12 JAN Middle Planning Meeting and Logistics Synch - Lansing
07-08 JAN NE17 TTX – Lansing
22 JUN Initial Planning Meeting ( 22 SEOC)
09-12 JUN JFHQ-MI CPX
23-27 MAY CPX16 TTX / MSEL / EXCON Synch
14-15 APR CPX16 Planning Meeting - Lansing
02 MAR NE17 Concept Development Meeting - Lansing
01 MAR All Hazards Plan Update
22 JAN CPX 16 Sr. Leader Concept Development Meeting
01 FEB Publish Initiating Exercise Directive
06 NOV Approved Concept/JELC
Version 15 13JUN16

9. NE17 Timeline ? Partnered Agencies 11 June 12 June 13 June 14 June
SUN
MON
TUE
WED
THU
FRI
SAT -2 -1 1 2 3 4 5
Multiple
Events
Warm Start
AAR
INCIDENT
INCIDENT
EXCON / LOCON Sync
Site Prep
JFHQ-MI (CPX)
EXCON COMMEX
O/C/T , EX SPT and Role Players Travel
EXCON Depart
EXCON Arrival
O/C/T, EX SPT and Role Players Depart ?
Partnered Agencies
CRPL 3
CRPL 2
CRPL 1
AS OF: AUG 2014

10. Exercise Understandings
Exercise will be Full Scale /Command Post Exercise (CPX) only
Functional Areas will determine participation, integration and coordination into the exercise
Each participating agency will be incur its own cost
No expectation of MING or MSP for reimbursement for personnel, equipment or other expenses.
Memorandum of Agreements will be signed between by each Participating Agency NLT Middle Planning Meeting

11. Transportation & Mobility
Scenario Focus
Functional Area Emphasis for NE17
MISSION COMMAND
CBRN/HAZMAT
COMMUNICATION & CYBER
POWER & INFRASTRUCTURE
MOBILITY
Mission Command
Communication
Cyber
Transportation & Mobility
Infrastructure &
Power
CBRN & HAZMAT IC
EOC
Functional Area/ ESF determines requirements & down trace participation.
Participating EOCs without participating down trace may require simulation.
Commercial Partners
EOC IC

12. Initial Planning Meeting Objectives
The intent of the IPM is to identify and develop exercise design, methodology and scenario concepts/events that support approved objectives and Mission Essential Tasks (METS):
Provide and synchronize participants training objectives
Discuss Exercise Planning Timeline planning dates to national guard forces, local, state, and federal partners
Validate exercise planning and product delivery milestones
Confirm initial interest in exercise participation
Develop initial requirements/concepts for Joint Reception, Staging, Onward Movement, and Integration (JRSOI), Movement, Maneuver, initial Life Support, Logistics, Command, Control, Communications, Computers, & Intelligence (C4I), Joint Visitors Bureau (JVB) and Identify external support / augmentation requirements
Develop training plan
Develop data collection cell template and augmentation requirements
Identify issues, assign Office of Primary Responsibility (OPR) for resolution and incorporate into the planning and products milestones

13. Primary Exercise Roles
Planning Team Member (Action Officer)
Lead Point of Contact (POC) for agency, unit or organization,
Should have a degree of decision making authority
Trusted Agents
Subject Matter Experts
Primary Scripting POC
Simulation Cell
Exercise Control Cell (EXCON)
Local Control Cell (LOCON)
Information & Knowledge Management (IM/KM) Managers
Monitors Information and provides situational awareness.
Exercise Control Cell (EXCON): Controls the Exercise
Local Control Cell (LOCON) : Simulates Units and Agencies

14. LTC Ravindra Wagh G5 Plans and Exercises Ms. Amanda Bresler MSP/EMHSD
2017 Objectives
LTC Ravindra Wagh
G5 Plans and Exercises
Ms. Amanda Bresler
MSP/EMHSD

15. 2017 Statewide Exercise Mission Statement
2017 Statewide Exercise, is a virtual and constructive Full Scale/Command Post Exercise from June 2017 to validate local and state agency plans, in addition to confirm the readiness of the Michigan National Guard to provide Defense Support of Civil Authorities.

16. Proposed Exercise Goals and Objectives
Educate exercise participants with a broad understanding of potential impacts of a long term power outage.
Provide exercise participants with a frame of reference, per agencies plan, for actions required to address impacts of a long term power outage to networks and critical infrastructure.
Evaluate impacts to state of Michigan lifelines and develop strategies to mitigate associated consequences.
Prioritize the urgency of issues facing the state of Michigan against those of states directly impacted and determine appropriate courses of action.
Develop and disseminate a uniform message to the public and media through the Joint Information Center utilizing all available mediums.

17. MING CDRs Exercise Intent
Purpose: Train and confirm the readiness of Michigan National Guard to provide support to civil authorities in a realistic constructive and simulated training environment.
Key Tasks:
Confirm the readiness of MING units to provide capability and support for State civil support missions
Increase MING interagency understanding and cooperation through incorporation of Military and Civilian Federal, State and Local partners
Exercise MING Dual Status Commander and JTF Staff in employment of State (SAD/Title 32) and Federal (Title 10) forces during a complex catastrophe
End State: MING is trained and confirmed ready to support civil authorities within deployment timelines.

18. MING Exercise Objectives
Confirm MING readiness to conduct mission command of forces in a multi- phased, dual-status Defense Support to Civil Authorities (DSCA) operation.
Stand-up of Joint Forces Headquarters (JFHQ-MI) and Joint Task Force (JTF).
Transition operational lead from JFHQ-MI to JTF.
Exercise full integration of JFHQ-MI and JTF in SEOC over three days of continuous 24 hour operations.
Coordinate and facilitate integration of Federal, State, and Local capabilities with MING throughout the duration of the exercise.
Exercise the incorporation of MING units into the National Response Framework and National Incident Management System.
Coordinate with and support a Unified Command at State level.
Maintain and report status of deploying assets, to include In Transit Visibility (ITV), as part of the ability to effectively command and control forces as they arrive and operate in the established Operations Area.
Integrate MING Cyber Network Defense Team into Commercial, State and Federal response to a targeted denial of services.

19. Response Structure

20. Critical RFA / Task Process Nodes
MA / MATO
DOD/ NORTHCOM/ ARNORTH / DCO
FEMA
FEMA
STRATEGIC
FEDERAL
ARF
MA / MATO
DMVA/
JFHQ-MI
Declined
State EOC
OPERATIONAL
PROPOSED: MSP
MDCH
MDEQ
MDOT
DMVA
DMTB
RFA
STATE
Accepted RFA Task
JTF/DSC
RFA
Task
TF /BDE’s
Area Command
COUNTY
Task
RFA
PROPOSED: Commercial Partners
BN’s
Task
Incident Commands
LOCAL
TACTICAL
CO’s
Problem
Assess
Execute

22. References
NOTIONAL FOR EXERCISE USE ONLY 24

23. Cyber Scenario for NE17
Cyber scenario for FEMA Region V based on Lloyd’s report “Business Blackout”
Malware goes undetected until it is triggered (zero day vulnerability).
Hackers covertly and systematically disable safety systems that would usually protect the generators from desynchronization events.
Multiple sites are compromised but protective relays make attack non-viable at 50% of these sites.
In roughly 10% of infection cases, attacker is able to access certain vulnerable generators:
Results in overload and burn out, in some cases causing physical damage.
Attack occurs during summer peak-day conditions.
Sudden reduction in generating capacity triggers blackout throughout FEMA Region V.
URL:

24. Grid Vulnerability

25. FEMA Priorities
….Craig Fugate
So what, I asked FEMA’s administrator, is the plan for such an outage? For the first couple of days, he explained, the primary burden would be on state and local governments, but if the electricity remained out for weeks or more, it would be FEMA trying to fill in the gaps. …Ted Koppel
“The plan would be to support the states to keep security, to maximize what power we do have to come back online, to look at what it will take to keep food and other critical systems like water systems up and running with generators and fuel. To prioritize where we’re going to start rebuilding our economy.” ….Craig Fugate
Ted Koppel quoting FEMA Director Craig Fugate in his book, “Lights Out”

26. FEMA Priorities Administrator Fugate warned that there’s a
limit to how much FEMA can do, but he’s
confident in prioritizing certain objectives.
“Keep the water on,” he said. “That means we need to have enough power to pump, treat, and distribute water through the system. You have to keep the water system up, and you’ve gotta then focus on the water treatment system. Backing up sewage is just about as bad.
Those two pieces will buy you enough time to look at what your alternatives are. Basically, people have to drink water, they have to eat, that waste has to go somewhere, they need medical care, they need a safe environment. There has to be order of law there.”
Ted Koppel quoting FEMA Director Craig Fugate in his book, “Lights Out”

27. Scenario Purpose Scope
The purpose of this scenario is to provide participating agencies with an opportunity to assess their preparedness, response and recovery protocols, plans, and capabilities in the event of a long-term power outage precipitated by a cyber attack on the US Electric Grid..
Scope
The power outage incident depicted is a catastrophic cyber-attack on the U.S. power grid conducted by unidentified hostile actors inserting malware into electricity control room systems months in advance to exploit industrial control system vulnerabilities. The resulting blackout impacts The attack is released in the Midwest United States, focusing efforts across two mutually supporting electric reliability regions (Midcontinent Independent System Operator, Inc. [MISO] and PJM Interconnection [PJM]).leaving 6 states in FEMA Region V and more than 40 million residents without power and creating cascading effects affecting communications, public health, transportation and commerce across a wide region.
NOTIONAL FOR EXERCISE USE ONLY
The National (ref. b) and DOD implementation plans (ref. d.) list tasks for the Department of Defense (DOD). Of these, DOD has the lead in 31 tasks and an undefined support role in some of the remaining 83 tasks. Additional tasks are found in the USNORTHCOM CONPLAN 3591 (ref. e), and other COCOM PI CONPLANS. Specific Army tasks, based on the task list in the Defense Implementation Plan (DIP) (ref. d), are listed in the USNORTHCOM Global Synchronization planning directive (ref. f).

28. Attack Methodology The cyber-attack is conducted in several stages.
NOTIONAL – FOR EXERCISE USE ONLY
The cyber-attack is conducted in several stages.
The malware embeds itself in the supervisory control and data acquisition (SCADA) systems of the local utilities as well as in the control centers of the independent system operators (ISOs).
Once activated, the overrides primary control functions of the SCADA systems.
Other latent malware remains dormant and is triggered by specific processes undertaken by operators as they attempt to isolate or restore systems within the grid.
The malware is designed to open a circuit breaker, wait for the system or generator to slip out of synchronization, and reclose the breaker—all before the protection system recognizes and responds to the attack.
The drop in reactive power supply will result in a sudden reduction in voltage at the substation and trigger voltage relays to isolate the substation from the grid.
At this point, both the generators and the associated substations will become disconnected from the grid.
Since the attack is wide in scope and involves a large number of generator units, widespread electric service interruptions would occur across the Midcontinent Independent System Operator (MISO) Grid.

29. Restoration Challenges
Unlike systems in the Ukraine, which were targeted by a less sophisticated attack on 23 December 2015, MISO systems, for the most part, lack a manual override option, which was used in Ukraine to restore limited service in a relatively short time.
In addition, the option to reconnect and import power from adjacent grids is not an option until the MISO systems have been repaired and “cleaned” of residual malware.
The loss of electricity will have severe effects on the densely populated urban communities across the six states in FEMA Region V. In the state of Michigan, severe impacts in the cities of Detroit and Grand Rapids.
Severe degradation of key infrastructure; ports, airports, hospitals, industrial production, sewer and water and military facilities will create an environment of crisis as the outages extend into several days and/or weeks.

30. Scenario Affected Population ~40 million Widespread Power Outages
NOTIONAL FOR EXERCISE USE ONLY
Power infrastructure attack
Widespread Power Outages
Industrial accidents
Disruption of Water/Sewer Services
Degradation of Health Services
Disruption to Transportation Services
Disruption to Commerce
Secondary TIC/TIM Releases
Civil Unrest
Scarcity of Commodities

31. MISO
NOTIONAL FOR EXERCISE USE ONLY
The National (ref. b) and DOD implementation plans (ref. d.) list tasks for the Department of Defense (DOD). Of these, DOD has the lead in 31 tasks and an undefined support role in some of the remaining 83 tasks. Additional tasks are found in the USNORTHCOM CONPLAN 3591 (ref. e), and other COCOM PI CONPLANS. Specific Army tasks, based on the task list in the Defense Implementation Plan (DIP) (ref. d), are listed in the USNORTHCOM Global Synchronization planning directive (ref. f).

32. FEMA Region V Outage Areas
NOTIONAL FOR EXERCISE USE ONLY
NOTIONAL FOR EXERCISE USE ONLY
LEGEND
> 80%
5-80%
< 5%

33. Proposed Mission Locations
NOTIONAL FOR EXERCISE USE ONLY
Area Cmd
Area Cmd
Area Cmd

34. Areas of Primary Concern
Communications
Commercial Power
Transportation
Food / Water Supplies
Medical Care Mass Care
HAZMAT/CBRN
Radiological Decontamination
Structural Damage
Evacuation
Contaminated Remains
Civil Disorder

35. Work Group Discussion
Ms. Bresler

36. Work Group Expectations
Workgroups will be broken down into branches:
Health and Environment Branch
Human Services
Public Safety

37. Primary Agency/Unit Exercise Roles
Planning Lead
Primary point of contact (POC) for agency, unit, or organization
Should have decision making authority
Trusted Agents
Subject Matter Expert
Primary Scripting POC
Simulation Cell
Exercise Control Center (EXCON): Controls the Exercise
Local Control Center (LOCON): Simulates Units and Agencies
IM/KM Managers
Monitors information and provides situational awareness

38. Post IPM Deliverables Define organizational objectives.
Proposed participation to include dates, personnel and potential participating agencies or commercial partners.
Proposed task organization and lines of communications.
Identify gaps that may be filled through simulation or recruitment.
Provide input to scenario.
Request for information
Issues & Concerns

39. Future Planning Priorities
Ensure objectives support policy, plan and leadership.
Confirm funding and resource available to patriciate before MPM.
Provide recommendations as it pertains to participants, & scenario, and systems.
Collaborate and nest common objectives.
Identification of Work Group Leaders
Facilitators Facilitate & Support
Functional Areas determine down trace
Compilation of your IPC objectives and ours
Boxes are so we can check them off prior to end of IPC

40. Questions? Mike Bridges, G5 Plans, JFHQ-MI
Cell:
Amanda M. Bresler MSP/EMHSD
Cell: